CVE-2026-25986: 
C# vulnerability analysis and mitigation

CVE-2026-25986 is a heap buffer overflow write vulnerability in ImageMagick's ReadYUVImage() function (coders/yuv.c) triggered when processing maliciously crafted YUV 4:2:2 (NoInterlace) images. The pixel-pair loop writes one pixel beyond the allocated row buffer, causing an out-of-bounds memory write. It affects ImageMagick versions prior to 7.1.2-15 (in the 7.x branch starting from 7.0.0-0) and prior to 6.9.13-40 (in the 6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. The vulnerability was published on February 23–24, 2026. The GitHub Security Advisory assigns a CVSS v3.1 score of 5.3 (Moderate), while the NVD entry carries a score of 9.8 (Critical) — the discrepancy reflects differing assessments of confidentiality and integrity impact (GitHub Advisory, Red Hat Bugzilla).

The root cause is an off-by-one out-of-bounds write (CWE-787, CWE-805) in the YUV decoder within coders/yuv.c. When processing YUV 4:2:2 NoInterlace images, the pixel-pair processing loop iterates one step beyond the end of the allocated row buffer, writing 8 bytes past the heap allocation boundary. An AddressSanitizer report confirms a WRITE of size 8 at an address beyond the allocated buffer (heap-buffer-overflow on address 0x5170000002e0). The attack vector is network-based and requires no authentication or user interaction — an attacker simply needs to supply a malicious YUV image to any application that passes user-controlled input to ImageMagick's YUV decoder (GitHub Advisory, Github Advisory).

The primary confirmed impact is denial of service through application crash caused by heap memory corruption. Depending on heap layout and exploitation sophistication, the out-of-bounds write could theoretically be leveraged for arbitrary code execution, which is reflected in the NVD's CVSS score of 9.8 with HIGH confidentiality, integrity, and availability impacts. Any application or service that processes user-supplied images via ImageMagick — including web applications, media pipelines, and document converters — is at risk of being crashed or potentially compromised by a remote, unauthenticated attacker (GitHub Advisory, Red Hat Bugzilla).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.027% (8th percentile), indicating a low near-term probability of exploitation. The vulnerability was reported by researcher ylwango613 and disclosed responsibly through GitHub's security advisory process (GitHub Advisory).

1. Craft a malicious YUV image: Create a specially crafted YUV 4:2:2 (NoInterlace) image file with dimensions or pixel data designed to trigger the off-by-one condition in the ReadYUVImage() pixel-pair loop in coders/yuv.c.
2. Identify a target: Locate a web application, API endpoint, or service that accepts image uploads or URLs and processes them using a vulnerable version of ImageMagick (prior to 7.1.2-15 or 6.9.13-40).
3. Submit the malicious image: Upload or submit the crafted YUV file to the target application, causing ImageMagick to invoke ReadYUVImage() on the attacker-controlled input.
4. Trigger the overflow: The pixel-pair loop writes one pixel (8 bytes) beyond the allocated row buffer, corrupting adjacent heap memory.
5. Achieve denial of service (or potentially RCE): The heap corruption causes an application crash (denial of service). With advanced heap grooming techniques, an attacker may attempt to control the overwritten memory to redirect execution flow, though no public exploit demonstrating RCE exists at this time (GitHub Advisory).

• Logs: Application logs showing unexpected crashes or segmentation faults in ImageMagick processes; error messages referencing coders/yuv.c or ReadYUVImage(); AddressSanitizer output indicating heap-buffer-overflow if ASan is enabled.
• File System: Presence of unusual .yuv image files in upload directories or temporary processing folders, particularly with anomalous dimensions or file sizes.
• Process: Unexpected termination of ImageMagick worker processes (convert, magick, or application-embedded ImageMagick calls) when processing image files; core dump files generated in the working directory of the ImageMagick process.
• Network: Repeated submission of YUV-format image files from a single source IP to an image-processing endpoint, especially if followed by service unavailability.

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). For Magick.NET NuGet users, upgrade to version 14.10.3 or later. As a workaround where patching is not immediately possible, restrict or disable processing of YUV image format inputs (e.g., via ImageMagick's policy.xml to deny the YUV coder), and limit network access to services that process user-supplied images. Linux distribution packages (Ubuntu USN-8069-1, Debian DSA-6158/6159/DLA-4497, openSUSE, SUSE, Amazon Linux 2 ALAS2-2026-3211) have also released updated packages (GitHub Advisory, Red Hat Bugzilla, Ubuntu Advisory).

The vulnerability was disclosed by researcher ylwango613 through GitHub's coordinated disclosure process and published by maintainer dlemstra on February 23, 2026. Red Hat tracked the issue as medium severity in their Bugzilla, characterizing it as a denial-of-service risk via malicious YUV image processing. Multiple Linux distributions — including Ubuntu, Debian, SUSE, openSUSE, and Amazon Linux — issued security advisories and updated packages within weeks of disclosure, reflecting standard industry response to a library vulnerability with broad ecosystem impact (GitHub Advisory, Red Hat Bugzilla, Ubuntu Advisory).